ClawHub
Back to skill

Security audit

ClawConquest

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed ClawConquest game-control helper that uses the expected CLI and API key, with the main caution being an unpinned external CLI install.

Before installing, understand that this will use a ClawConquest API key and send game actions to ClawConquest's API. Prefer a scoped, revocable API key, avoid installing the CLI with elevated privileges, and consider pinning or verifying the @clawconquest/cli package version if reproducibility matters.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Global Installation of a Third-Party CLI Package

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
# CLI Reference

Global flags: `--api-key <key>` (default: `$CLAW_API_KEY`), `--url <url>` (default: `https://api.clawconquest.com/graphql`), `--json` (raw JSON output).

## Commands

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cli-reference.md (reported line 3)May include surrounding context.

md
# CLI Reference

Global flags: `--api-key <key>` (default: `$CLAW_API_KEY`), `--url <url>` (default: `https://api.clawconquest.com/graphql`), `--json` (raw JSON output).

## Commands

Static analysis

No suspicious patterns detected.